On 31 October 2025, every 2013 certificate stopped being valid.
Zikomo carries both control sets and the mapping between them. Choose either at onboarding, then see precisely which controls your last assessment never asked about.
Control references and titles are the standard's own. The implementation guidance in Zikomo is written by GUUT.
Four of the ninety-three, as the crosswalk records them.
114 into 93
Fewer controls does not mean less work.
The 2022 edition consolidated overlapping controls and introduced eleven that did not exist before. A register mapped forward shrinks in one column and grows in another, and the second column is the one that matters.
Institutions still certified against the 2013 edition require a full audit against 2022 rather than a transition audit. The crosswalk below is what that conversation starts from.
Specimen output
The mapping is not one to one, and the gap is where the risk lives.
Your 2013 assessment covered 114 controls. Mapped to 2022, eleven were never evaluated, because they did not exist when it was written.
| Ref | Control | Theme | 2013 equivalent |
|---|---|---|---|
| A.5.7 | Threat intelligence | Organizational | None |
| A.5.23 | Information security for use of cloud services | Organizational | None |
| A.5.30 | ICT readiness for business continuity | Organizational | None |
| A.7.4 | Physical security monitoring | Physical | None |
| A.8.9 | Configuration management | Technological | None |
| A.8.10 | Information deletion | Technological | None |
| A.8.11 | Data masking | Technological | None |
| A.8.12 | Data leakage prevention | Technological | None |
| A.8.16 | Monitoring activities | Technological | None |
| A.8.23 | Web filtering | Technological | None |
| A.8.28 | Secure coding | Technological | None |
Five movements
Five ways a control can move between versions.
One to one
Carried across, sometimes renamed, same intent. The finding moves with it.
Relation: identicalMany to one
Several 2013 controls consolidated into a single 2022 control. Several old findings now land on one reference.
Relation: mergedOne to many
A single control separated into more than one. One old finding has to be assessed again in parts.
Relation: splitNo ancestor
Eleven controls with nothing to map back to. Never assessed, never scored, invisible on a 2013 register.
Relation: newNo successor
Retired in the 2022 edition. The historical finding stays in the record but no longer carries forward.
Relation: droppedAsked in procurement
Frameworks, plainly.
Can we keep using ISO 27001:2013?
Yes, and Zikomo supports it fully. You should know what it means: the transition window closed on 31 October 2025, so a 2013 assessment no longer supports a valid certificate. Institutions choose it for continuity with an existing register, for an internal audit baseline, or because a specific mapping was requested. Zikomo records the reason against the cycle.
What happens to our existing register when we move to 2022?
Moving version starts a new assessment cycle rather than editing the current one, because risks reference specific control identifiers. The crosswalk then shows which findings carry forward, which merge onto a single new control, and which eleven controls have never been assessed at all.
Is the control guidance in Zikomo ISO's own text?
No. Control reference numbers and titles are the standard's own and are used as references. The implementation guidance in the platform is written by GUUT in plain English, because ISO's prose is written for auditors rather than for the person completing an assessment on a Thursday afternoon.
Can we add NIST CSF or PCI DSS later?
The framework is a row in a table, not a branch in the code. Adding one is loading its control set and its mapping, after which it appears in the onboarding picker and flows through the same questionnaire, scoring engine, reports and exports. It is data entry, not development.
Who supplies the control library?
GUUT does, as part of the platform. Both control sets and the mapping between them ship configured, so an institution does not assemble a reference library before it can begin.
2013 register
Find out what your last assessment never asked.
We import the register you have, map it forward to the 2022 control set, and hand you the list of controls that were never evaluated.